Fallos del tipo CWE-755

273 resultados

Tratamento inadequado de condições excepcionais

O código falha em capturar, validar ou responder corretamente a situações de erro ou exceção. Isso deixa o programa em estado inconsistente, pode expor informações sensíveis em mensagens de erro, ou permite que um atacante contorne controles de segurança explorando caminhos de exceção não previstos.

Ejemplo

Um sistema de login que lança uma exceção genérica quando o banco de dados falha, mas não a trata adequadamente — a stack trace é exibida na resposta HTTP, revelando arquitetura interna e caminhos do servidor. Ou um processamento de arquivo que não verifica se a leitura falhou antes de usar o conteúdo, causando comportamento indefinido.

Cómo mitigar

Sempre capture exceções esperadas com try-catch (ou equivalente na linguagem) e implemente tratamento específico para cada cenário de erro. Nunca expor stack traces ou detalhes técnicos ao usuário final; registre internamente e retorne mensagens genéricas. Valide o estado do programa após qualquer operação que possa falhar antes de prosseguir.

CVE-2026-96294HIGHApache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connectionEPSS 0.3%CVE-2026-90440HIGHApache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny serviceEPSS 0.3%CVE-2026-42545MEDIUMGranian: DoS via WSGI response header panicEPSS 0.3%CVE-2022-32657MEDIUMIn Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege wiEPSS 0.3%CVE-2022-32658MEDIUMIn Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege wiEPSS 0.3%CVE-2022-32659MEDIUMIn Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege wiEPSS 0.3%CVE-2020-25236MEDIUMA vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versionEPSS 0.3%CVE-2026-0203HIGHJunos OS: Receipt of a specifically malformed ICMP packet causes an FPC restartEPSS 0.3%CVE-2026-48961HIGHIO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GIDEPSS 0.3%CVE-2026-54580HIGHmport index decompression can leave partial or corrupt index data after zstd failuresEPSS 0.3%CVE-2022-0264—A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be retEPSS 0.3%CVE-2022-21218MEDIUMUncaught exception in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable EPSS 0.3%CVE-2026-102716HIGHA malformed Session header permanently orphans one packet-pool block per RTSP requestEPSS 0.3%CVE-2026-63450LOWSuricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detectionEPSS 0.2%CVE-2025-21602HIGHJunos OS and Junos OS Evolved: Receipt of specially crafted BGP update packet causes RPD crashEPSS 0.2%CVE-2024-39560HIGHJunos OS and Junos OS Evolved: Memory leak due to RSVP neighbor persistent error leading to kernel crashEPSS 0.2%CVE-2023-5090MEDIUMKernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrsEPSS 0.2%CVE-2026-72752MEDIUMRoutinator exits when requesting the output repeatedlyEPSS 0.2%CVE-2024-50202MEDIUMnilfs2: propagate directory read errors from nilfs_find_entry()EPSS 0.2%CVE-2025-53702HIGHDoS vulnerability in Vilar VS-IPC1002 IP camerasEPSS 0.2%